Implementing Shor's algorithm on Josephson Charge Qubits 
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We investigate the physical implementation of Shor's factorization algorithm on a Josephson 
charge qubit register. While we pursue a universal method to factor a composite integer of any 
size, the scheme is demonstrated for the number 21. We consider both the physical and algorith- 
mic requirements for an optimal implementation when only a small number of qubits is available. 
These aspects of quantum computation are usually the topics of separate research communities; we 
present a unifying discussion of both of these fundamental features bridging Shor's algorithm to its 
physical realization using Josephson junction qubits. In order to meet the stringent requirements 
set by a short decoherence time, we accelerate the algorithm by decomposing the quantum circuit 
into tailored two- and three-qubit gates and we find their physical realizations through numerical 
optimization. 
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I. INTRODUCTION 



Quantum computers have potentially superior com- 
puting power over their classical counterparts 0, 0- 
The novel computing principles which are based on the 
quantum-mechanical superposition of states and their 
entanglement manifest, for example, in Shor's integer- 
factorization algorithm [j| and in Grover's database 
search 0|. In this paper we focus on Shor's algorithm 
which is important owing to its potential applications 
in (de)cryptography. Many widely applied methods of 
public-key cryptography are currently based on the RSA 
algorithm |j| which relies on the computational difficulty 
of factoring large integers. 

Recently, remarkable progress towards the experimen- 
tal realization of a quantum computer has been accom- 
plished, for instance, using nuclear spins H B , tr apped 
ions H, Q, cavity quantum electrodynamics jlCj . elec- 
trons in quantum dots [ll|, and superconducting circuits 
El III Hi III El 113 However, the construction of a 
large multiqubit register remains extremely challenging. 
The very many degrees of freedom of the environment 
tend to become entangled with those of the qubit register 
which results in undesirable decoherence 18]. This im- 
poses a limit on the coherent execution time available for 
the quantum computation. The shortness of the decoher- 
ence time may present fundamental difficulties in scaling 
the quantum register up to large sizes, which is the ba- 
sic requirement for the realization of nontrivial quantum 
algorithms [Tgj j. 
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In this paper, we consider an inductively coupled 
charge-qubit model [2(j. Josephson-junction circuits pro- 
vide two-state pseudospin systems whose different spin 
components correspond to distinct macroscopic variables: 
cither the charges on the superconducting islands or the 
phase differences over the Josephson junctions. Thus, de- 
pending on the parameter values for the setup, one has 
flux El G3 , or charge qubits El El El El El . Thus 
far the largest quantum register, comprising of seven 
qubits, has been demonstrated for nuclear magnetic reso- 
nance (NMR) in a liquid solution Q. However, the NMR 
technique is not believed to be scalable to much larger 
registers. In contrast, the superconducting Josephson- 
junction circuits are supposed to provide scalable regis- 
ters and hence to be better applicable for large quantum 
algorithms [2^|. Furthermore, they allow integration of 
the control and measurement electronics. On the other 
hand, the strong coupling to the environment through 
the electrical leads [23| causes short decoherence times. 

In addition to the quantum register, one needs a quan- 
tum gate "library" , i.e., a collection of control parameter 
sequences which implements the gate operations on the 
quantum register. The quantum gate library must con- 
sist of at least a set of universal elementary gates |24j . 
which are typically chosen to be the one-qubit unitary 
rotations and the CNOT gate. Some complicated gates 
may also be included in the library. 

The quantum circuit made of these gates resembles the 
operational principle of a conventional digital computer. 
To minimize the number of gates, the structure of the 
quantum circuit can be optimized using methods similar 
to those in digital computing [25|. Minimizing the num- 
ber of gates is important not only for fighting decoher- 
ence but also for decreasing accumulative errors of clas- 
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sical origin. If some tailored two-, three- or arbitrary k- 
qubit gates are included in the gate library, the quantum 
circuits may be made much more compact. The imple- 
mentation of gates acting on more than two qubits calls 
for numerical optimization j2|| . For further discussion on 
the implementation of non-standard gates as the building 
blocks for quantum circuits, see Refs. |27l I2H , 12^. l30l| . 

We propose an implementation of Shor's algorithm for 
factoring moderately large integers - we deal with both 
algorithmic and hardware issues in this paper. These are 
two key aspects of quantum computation which, how- 
ever, have traditionally been topics of disjoint research 
communities. Hence we aim to provide a unifying dis- 
cussion where an expert on quantum algorithms can gain 
insight into the realizations using Josephson junctions 
and experimentalists working with Josephson devices can 
choose to read about the quantum algorithmic aspects. 
The background material on the construction of a quan- 
tum circuit needed for the evaluation of the modular ex- 
ponential function [3ll l3^| is presented in Appendix A 
and a derivation of the effective Hamiltonian for a collec- 
tion of inductively coupled Josephson qubits is given in 
Appendix B. 

This paper is organized as follows: The construction 
of a quantum gate array for Shor's algorithm is discussed 
in Sec.[n] In Scc. lIIII we consider the Josephson chargc- 
qubit register. Section llVI presents the numerical meth- 
ods we have employed to find the physical implementa- 
tions of the gates. Section discusses in detail how one 
would realize Shor's algorithm using Josephson charge 
qubits to factor the number 21. Section IVll is devoted to 
discussion. 



II. SHOR'S FACTORIZATION ALGORITHM 



|x=0>. 




period r 



a x (modN)) 



FIG. 1: Quantum circuit for Shor's algorithm. 



quantum circuit. However, if a large number of qubits 
is available, the design can be easily modified to take as 
an input the numerical values of the numbers a and N 
residing in separate quantum registers. The hardwired 
approach combined with as much classical computing as 
possible is considerably more efficient from the experi- 
mental point of view. 

Figure 1 represents the quantum circuit needed for 
finding the period r. Shor's algorithm has five stages: (1) 
Initialization of the quantum registers. The number N 
takes n = |~log 2 (iV + 1)] bits to store into memory, where 
\v~\ stands for the nearest integer equal to or greater than 
the real number v. To extract the period of f(x), we need 
at least two registers: 2n qubits for the register \x)2 n to 
store numbers x and n qubits for the register \y) n to 
store the values of f(x). The register \x)2n is initialized 
as |0)2n, whereas \y) n = |1}„. (2) The elegance of a 
quantum computer arises from the possibility to utilize 
arbitrary superpositions. The superposition state of all 
integers < x < 2 2n — 1 in the register \x)2 n is gener- 
ated by applying the Hadamard gate H on each qubit 
separately. (3) The execution of the algorithm, the uni- 
tary operator Uf, entangles each input value x with the 
corresponding value of f{x): 



With the help of a quantum computer, one could fac- 
tor large composite numbers in polynomial time using 
Shor's algorithm [jl |3i| |2 EH ■ in contrast, no classi- 
cal polynomial time factorization algorithm is known to 
date, although the potential existence of such an algo- 
rithm has not been ruled out, either. 



A. Quantum circuit 

The strategy for the factoring of a number N = pq, 
both p and q being primes, using a quantum computer 
relies on finding the period r of the modular exponential 
function f(x) = a x (mod N), where < a < N is a ran- 
dom number coprime to N. For an even r, at least one 
prime factor of N is given by gcd(a r / 2 ± 1,N). Other- 
wise, a quantum algorithm must be executed for different 
values for a until an even r is found. 

The evaluation of f(x) can be implemented using sev- 
eral different techniques. To obtain the implementation 
which involves the minimal number of qubits, one as- 
sumes that the numbers a and N arc hardwired in the 



£//]>>>|i> = ]>>>K (™d ao). (i) 

X X 

(4) The quantum Fourier transformation (QFT) is ap- 
plied to the register \x}2n, which squeezes the probabil- 
ity amplitudes into peaks due to the periodicity f(x) = 
f(x + r). (5) A measurement of the register \x)2n finally 
yields an indication of the period r. A repetitive execu- 
tion of the algorithm reveals the probability distribution 
which is peaked at the value 2 2n /r and its integer multi- 
ples of output values in the register |ir)2n- 

Besides the quantum algorithm which is used to find 
r, a considerable amount of classical precomputing and 
postprocessing is required as well. However, all this com- 
puting can be performed in polynomial time. 



B. Implementing the modular exponential function 

We arc looking for a general scalable algorithm to im- 
plement the required modular exponential function. The 



implementation of this part of the algorithm sets lim- 
its for the spatial and temporal requirements of com- 
putational resources, hence it requires a detailed analy- 
sis. The remarkable experimental results Q to factor the 
number 15 involve an elegant quantum circuit of seven 
qubits and only a few simple quantum gates. The imple- 
mentation definitely exploits the special properties of the 
number 15, and the fact that the outcome of the function 
a x (mod N) can be calculated classically in advance for 
all input values x when N is small. For arbitrary N l re- 
versible arithmetic algorithms must be employed |3a . l37| . 
The classical arithmetic algorithms [38|. can be imple- 
mented reversibly by replacing the irreversible logic gates 
by their reversible counterparts. The longhand multipli- 
cation algorithm, which we use below, should be optimal 
up to very large numbers, requiring only 0(n) qubits and 
0(n 3 ) step. 

The implementation of the modular exponential func- 
tion using a longhand multiplication algorithm and a 
QFT-based adder [3l| provides us with small scratch 
space requiring only a total space of An + 2 qubits. The 
details of the implementation are given in Appendix A. 
The conventional approach to longhand multiplication 
without a QFT-based adder would require on the order 
of 5n qubits. The price of the reduced space is the in- 
crease in the execution time, which now is 0(n 4 ), but 
which can be reduced down to 0(n 3 log 2 "), allowing for 
a certain error level e. According to Ref. (31J one would 
achieve an algorithm requiring only 2n + 3 qubits with 
intermediate measurements. However, we do not utilize 
this implementation since the measurements are likely to 
introduce dccohercncc. 



III. JOSEPHSON CHARGE-QUBIT REGISTER 

The physical model studied in this paper is the so- 
called inductively coupled Cooper pair box array. This 
model, as well as other related realizations of quantum 
computing, has been analyzed in Ref. poj j. The deriva- 
tion of the Hamiltonian is outlined in Appendix ^] for 
completeness. Our approach to quantum gate construc- 
tion is slightly different from those found in the literature 
and it is therefore worthwhile to consider the physical 
model in some detail. 

A schematic picture of a homogeneous array of qubits 
is shown in Fig. [21 Each qubit i comprises a supercon- 
ducting island coupled capacitively to a gate voltage and 
a SQUID loop through which Cooper pairs may tunnel. 
The gate voltage may be used to tune the effective gate 
charge n g of the island whereas the external magnetic 
flux through the SQUID can be used to control the ef- 
fective Josephson energy. Each qubit is characterized by 
a charging energy Eq and a tunable Josephson energy 
Ej($i), where <E>, is the flux threading the SQUID. The 
Hamiltonian for the i th qubit can be written as 

Single = -^Wl ~ 2 B%X °* ^ 
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FIG. 2: a) Schematic of a Josephson charge qubit with the 
relevant parameters, b) An array of Josephson charge qubits 
coupled in parallel with an inductor. 

and the coupling between the i th and j th qubits as 

K:^... ci'J'iK 4 ■ (3) 

The qubit state |0) ("spin up") corresponds to zero ex- 
tra Cooper pairs residing on the island and the state 
1) ("spin down") corresponds to one extra pair on the 
island. Above B% = E 3 ($i), B\ = E c (l - 2n g ) and 

C = tt 2 L/$>q (Cqb/Cj) 2 denotes the strength of the cou- 
pling between the qubits, whereas C q b is the total capac- 
itance of a qubit in the circuit, Cj is the capacitance of 
the SQUID, L is the inductance which may in practice 
be caused by a large Josephson junction operating in the 
linear regime and finally <& = h/2e is the flux quantum. 
The approach taken is to deal with the parameters B\ 
and B\, as dimensionless control parameters. We assume 
that they can be set equal to zero which is in principle 
possible if the SQUID junctions are identical. We set 
C = 1 and choose natural units such that h = 1. 

The Hamiltonian in Eqs. (j2J{3J) is a convenient model 
for studying the construction of quantum algorithms for a 
number of reasons. First of all, each single-qubit Hamil- 
tonian can be set to zero, thereby eliminating all tem- 
poral evolution. Secondly, setting the effective Joseph- 
son coupling to zero eliminates the coupling between any 
two qubits. This is achieved by applying half a flux quan- 
tum through the SQUID loops. If the Josephson energy 
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FIG. 3: Pulse sequence implementing an equivalent of the 
Hadamard gate. Solid line indicates B l x while the dashed line 
shows B l z . 

of any two qubits is nonzero, there will automatically 
emerge a coupling between them. This is partly why 
numerical methods are necessary for finding the control- 
parameter sequences. By properly tuning the gate volt- 
ages and fluxes it is possible to compensate undesircd 
couplings and to perform any temporal evolution in this 
model setup. 

We note that the generators ia x and icr z are sufficient 
to construct all the SU(2) matrices through the Baker- 
Campbell-Hausdorff formula and thus single-qubit gates 
need not be constructed numerically. It is even possible 
to do this in a piecewise linear manner avoiding abrupt 
switching since the only relevant parameter is the time 
integral of either B\ or B l x if only one of them is nonzero 
at a time. That is, any U E SU (2) acting on the i th qubit 
can be written as 

U = j< ig B*(t)dt/2 e K S* (t)dt/2 e ial /£ Bl(t)dt/2 

(4) 

where we assume that from to to t\ only B\ is nonzero, 
from t\ to t<x only B l x is nonzero and from i 2 to £3 only 
B\ is again nonzero. For instance, the gate iH E SU(2), 
equivalent to the Hadamard gate H E U(2) up to a global 
phase, can be realized as in Fig. [21 by properly choosing 
the time-integrals in Eq. Q). We cannot achieve U(2 n ) 
for n qubits since the Hamiltonian for the entire quantum 
register turns out to be traceless, thus producing only 
SU(2 n ) matrices. However, the global phase factor is 
not physical here since it is not observable. 

The above Hamiltonian is an idealization and does not 
take any decoherence mechanisms into account. To jus- 
tify this omission, we have to ensure that a charge-qubit 
register is decoherence- free for time scales long enough to 
execute a practical quantum algorithm. In addition, we 
have neglected the inhomogenity of the SQUIDs. It may 
be extremely challenging to fabricate sufficiently uniform 
junctions. A three-junction design might alleviate this 
problem. Whereas for the control of N two-junction 
SQUIDs one needs at least N independent sources of flux, 
the three-junction design would call for 2N independent 
sources. The extra sources may be used to compensate 
the structural nonuniformities. The noise in the control 
parameters has also been neglected but it will turn out 
that the error will grow linearly with the rms displace- 
ment of uncorrclated Gaussian noise. Correlated noise 
may only be tolerated if it is very weak. We have also 



neglected the issue of quantum measurement altogether 
in the above. 

A crucial assumption is that fceTlniVqp <C Ej <C 
Ec <C AbcS: where N qp is the number of quasiparti- 
cle modes. Typical operation frequencies would be in 
the GHz range and the operation temperature could be 
tens of mK. For our two-state Hamiltonian to apply, we 
should actually insist that, instead of Ej <C Ec, the re- 
quirement <C Ec holds. It may appear at first 
that B x cannot take on values exceeding B\. However, 
this does not hold since the gate charge also plays a role; 
values of B\ can be very small if n g is tuned close to one 
half. Since we employ natural units we may freely rescale 
the Hamiltonian while rcscaling time. This justifies our 
choice C = 1 above. Furthermore, it is always possible 
to confine the parameter values within an experimentally 
accessible range. For more discussion, see Ref. poj . 

IV. IMPLEMENTING A QUANTUM-GATE 
LIBRARY 

The evaluation of the time-development operator U is 
straightforward once the externally controlled physical 
parameters for the quantum register are given. Here we 
use numerical optimization to solve the inverse problem; 
namely, we find the proper sequence for the control vari- 
ables which produce the given quantum gate. 

A. Unitary time evolution 

The temporal evolution of the Josephson charge-qubit 
register is described by a unitary operator 

C/ 7(t) =Tcxpl-i f H(j(t))dt ) , (5) 
V h(t) j 

where T stands for the time-ordering operator and 
W(7(t)) is the Hamiltonian for the qubit register. The 
integration is performed along the path 7(f) which de- 
scribes the time evolution of the control parameters in 
the space spanned by {B x {t)} and {Bl(t)}. 

Instead of considering paths y(t) with infinitely many 
degrees of freedom, we focus on paths parametrized by 
a finite set of parameters A 7 . This is accomplished by 
restricting the path j(t) to polygons in the parameter 
space. Since the pulse sequence starts and ends at the ori- 
gin, it becomes possible to consistently arrange gates as a 
sequence. For an n-qubit register, the control-parameter 
path j(t) is of the vector form 

7 (t)=[Bj(t) l ... ,B?(t); Bl(t), ... ,B%(t)] T , (6) 

where B\(t) and Bl(t) are piecewise linear functions of 
time for the chosen parametrization. Hence, in order 
to evaluate Eq. JSJ), one only needs to specify the 2n 
coordinates for the v vertices of the polygon, which we 
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denote collectively as X 1 . We let the parameter loop 
start at the origin, i.e., at the degeneracy point where no 
time development takes place. We further set the time 
spent in traversing each edge of the polygon to be unity. 

In our scheme, the execution time for each quantum 
gate depends linearly on the number v of the vertices 
in the parameter path. This yields a nontrivial relation 
between the execution time of the algorithm and the size 
of the gates. First note that each A:-qubit gate represents 
a matrix in SU (2 fc ). To implement the gate, one needs to 
have enough vertices to parameterize the unitary group 
SU(2 k ), which has 2 2k — 1 generators. In our model, 
we have 2k parameters for each vertex, which implies 
2kv > 2 2k — 1. We have used v = 4 for the two-, and 
v = 11 for the three-qubit gates. 

To evaluate the unitary operator ?7 7 (t) we must find 
a numerical method which is efficient, yet numerically 
stable. We divide the path j(t) into tiny intervals that 
take a time At to traverse. If 7* collectively denotes the 
values of all the parameters in the midpoint of the i th 
interval, and m is the number of such intervals, we then 
find to a good approximation 

U Xy « exp(-iW( 7m )Ai) . . . exp(-iW( 7l )Ai) . (7) 

We employ the truncated Taylor series expansion 

jfej — ( 8 ) 

to evaluate each factor in Eq. Q. We could use the 
Caylcy form 

e -iWAt w ^ _ lH At/2){l + iHAt/2)~\ (9) 

or an adaptive Runge-Kutta method to integrate the 
Schrodingcr equation as well. It turns out that the Taylor 
expansion with I = 3 is fast and yields enough precision 
for our purposes. The precision and unitarity of the ap- 
proximation are verified by comparing the results with 
those obtained with an exact spectral decomposition of 
H. 



B. Minimization of the error function 

Given an arbitrary matrix U, our aim is to find a pa- 
rameter sequence A 7 for the Josephson charge-qubit reg- 
ister that yields a unitary matrix U x = U. We convert 
the inverse problem into an optimization task; namely, 
that of finding the zeroes of the error function 

p(X J ) = \\U-U x J F . (10) 

Minimizing p(X~ t ) over all the possible values of A 7 will 
produce an approximation Ux for the desired gate U. 
Above || • || p denotes the Frobenius trace norm, defined 
as ||j4||f = \/Tr (At A), which is numerically efficient to 
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function evaluations 

FIG. 4: Convergence of the algorithm for the Fredkin gate. 
The error function values are indicated by the solid line and 
the distance of the parameter sequence from the numerical 
optimum X m i n by the dotted line. 

compute. Since all the matrix norms are mathematically 
equivalent, a small value of ||A||f implies a small value 
in all other norms as well, see e.g. Ref. [3^ |. 

For this minimization problem, the error-function 
landscape is rough consisting of many local minima. Con- 
sequently, any gradient-based minimization algorithm 
will encounter serious problems. Thus, we have found 
the minimum point X m in for all the gates presented in 
Sec. [V] using repeated application of a robust polytope 
algorithm [30L l40l Elj . In the first search, the initial 
condition was chosen randomly. At the next stage, the 
outcome of the previous search was utilized. In order 
to accelerate the evaluation of U^n) we varied the time 
steps At; at an early stage of the optimization a coarse 
step was employed while the final results were produced 
using very fine steps. Typical convergence of the search 
algorithm is illustrated in Fig. 0] 

The required accuracy for the gate operations is in the 
range 10~ 4 - 10 -5 for p{X 1 ) for two reasons: (i) in quan- 
tum circuits with a small number of gates, the total error 
remains small, and (ii) for large circuits, quantum-error 
correction can in prin ciple be utilized to reduce the ac- 
cumulated errors [l9j . Our minimization routine takes 
on the order of 10 6 function evaluations to reach the re- 
quired accuracy. 

V. EXAMPLE 

To demonstrate the level of complexity for the quan- 
tum circuit and the demands on the execution time, we 
explicitly present the quantum circuit and some physical 
implementation for the gates needed for Shor's algorithm 
to factor the number N = 21. We choose a = 11 and 
hardwire this into the quantum circuit. 
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A. Quantum Circuit 

Figure [S] illustrates the structure of the quantum part 
of the factorization algorithm for the number 21. Since 
it takes 5 bits to store the number 21, a 5-qubit register 
z/}5 and a 10-qubit register |a;)io are required. 

For scratch space we need a six-qubit register z) 6 and 
one ancilla qubit \a). Each thirteen-qubit controlled- 
MMUL (modular multiplier) gate in the algorithm can 
be further decomposed as indicated in Fig. [5] The 
controlled-MADD (modular adder) gates can also be de- 
composed. The ten-qubit QFT breaks down to 42 two- 
qubit gates and one three-qubit QFT. Similarly, the six- 
qubit QFT can be equivalently implemented as a se- 
quence of 18 two-qubit gates and one three-qubit QFT. 
In this manner we can implement the entire algorithm 
using only one-, two- and three-qubit gates. The con- 
trol parameter sequence realizing each of them can then 
be found using the scheme outlined in Sec. II VI Two ex- 
amples of the pulse sequences are also shown in Fig. [5] 
(bottom insets). 

B. Physical implementation 

The experimental feasibility of the algorithm depends 
on how complicated it is compared to the present state 
of technology. Following the above construction of the 
quantum circuit, the full Shor algorithm to factor 21 re- 
quires about 2300 three-qubit gates and some 5900 two- 
qubit gates, in total. Also a few one-qubit gates are 
needed but alternatively they can all be merged into the 
multi-qubit gates. If only two-qubit gates are available, 
about 16400 of them are required. If only a minimal set 
of elementary gates, say the CNOT gate and one-qubit 
rotations are available, the total number of gates is re- 
markably higher. In our scheme the execution time of 
the algorithm is proportional to the total length of the 
piecewise linear parameter path which governs the phys- 
ical implementation of the gate operations. Each of the 
three-qubit gates requires at least a 12-edged polygonal 
path j(t) whereas two-qubit gates can be implemented 
with 5 edges. Consequently, on the order of 57100 edges 
are required for the whole algorithm if arbitrary three- 
qubit gates are available, whereas ~ 82000 edges would 
be required for an implementation with only two-qubit 
gates. 

The ability to find the physical implementation of the 
gate library for Shor's algorithm is demonstrated with 
some further examples. Figure shows how to phys- 
ically implement the controlled swap gate. We have 
taken advantage of tailored thrcc-qubit implementations: 
a one-qubit phase-shift gate and a three-qubit controlled" 
phase-shift gate are merged into one three-qubit gate, see 
Fig.0 

The control parameter sequences presented will yield 
unitary operations which approximate the desired gate 
operations with an accuracy better than 10 -4 in the 



error-function values for the three-qubit gates. For two- 
qubit gates the error is negligible. Since the whole fac- 
torization circuit consists of some 10 3 three-qubit gates, 
we obtain a total error of ~ 10 _1 . This is sufficient for 
the deduction of the essential information from the out- 
put. The robustness of the gates obtained was studied 
numerically by adding Gaussian noise to the vertices of 
the path. The error function was found to scale linearly 
with the rms of the variance of the Gaussian noise: error 
ps 6 x(noise) rms , which is probably acceptable. 



VI. DISCUSSION 

In this paper we have discussed the implementation of 
Shor's factorization algorithm using a Josephson chargc- 
qubit register. This method is suitable for the first ex- 
perimental demonstration of factoring a medium-scale in- 
teger 2 4 - 2 20 . As an example of this method we have 
studied the algorithm for factoring 21. The only integer 
smaller than 21 for which Shor's algorithm is applicable 
is 15, but this is a special case having only the periods 2 
and 4. For the experimental factoring of 15 one should 
consider more direct methods Q to implement the mod- 
ular exponential function. For a larger integer N other 
approaches, e.g. the Schonhage-Strassen multiplication 
algorithm, will provide a more efficient quantum circuit. 
Our approach of numerically determining the optimized 
gates can be generalized to other physical realizations 
with tunable couplings as well. The only requirement 
is that the system allows total control over the control 
parameters. 

We have found that the number of qubits and quantum 
gates that are involved in carrying out the algorithm is 
rather large from the point of view of current technology. 
Thus the realization of a general factorization algorithm 
for a large integer N will be challenging. Consequently, 
the scaling of the chosen algorithm, both in time and 
space, will be of prime importance. 

The method we propose utilizes thrcc-qubit gates, 
which compress the required quantum-gate array, result- 
ing in a shorter execution time and smaller errors. One 
should also consider other implementations of the quan- 
tum algorithms that employ gates acting on a larger num- 
ber of qubits to further decrease the number of gates and 
execution time. For example, four-qubit gates may be 
achievable, but this involves harder numerical optimiza- 
tion. 

Finally, let us consider the experimental feasibility of 
our scheme. To factor the number 21, we need on the 
order of 10 4 edges along the control-parameter path. As- 
suming that the coherence time is on the order of 10 -6 s 
implies that the upper limit for the duration of each edge 
is 10~ 10 s. Since our dimensionless control parameters in 
the examples are on the order of unity, the energy scale 
in angular frequencies must be at least on the order of 
10 10 s _1 . Typical charging energies for, say, thin-film alu- 
minum structures may be on the order of 10 -23 J which 
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execution time 

FIG. 5: Quantum circuit for Shor's algorithm factoring the number 21 with the parameter value a = 11. The full circuit is 
shown topmost and the decompositions of the modular multiplier and adder blocks are indicated with dashed lines. The gates 
in the circuit have their conventional meanings, except that we denote a phase-shift gate by a box with a single number <j> in 
it meaning that the phase of the state |1) is shifted by e 2 '™'*'' 2 with respect to the state |0). Two examples of numerically 
optimized parameter sequences are also shown. 
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FIG. 6: Control parameters for the Fredkin gate. Solid line 
indicates B\ while the dashed line shows B % x . 




2 4 6 8 10 12 

execution time 



FIG. 7: Control parameters for a composite gate consisting 
of a controlled 2 phase shift and a one-qubit rotation, see text. 
Solid line indicates B\ while the dashed line shows B\.. 



corresponds to 10 11 s _1 . The ultimate limiting energy 
scale is the BCS gap, which for thin-film aluminum cor- 
responds to an angular frequency of about 3 x 10 11 s _1 . 
Based on these rough estimates, we argue that factoring 
the number 21 on Joscphson charge qubits is, in princi- 
ple, experimentally accessible. 

Constructing a quantum algorithm to decrypt RSA- 
155 coding which involves a 512-bit integer TV with the 
scheme that we have presented would require on the or- 
der of 2000 qubits. Assuming that the execution time 
scales as n 3 log n implies that tens of seconds of decoher- 
ence time is needed. This agrees with the estimates in 
Ref. ^3 an d poses a huge experimental challenge. This 
can be compared to the 8000 MIPS (Million Instructions 
Per Second) years of classical computing power which is 
needed to decrypt the code using the general numeric 
field sieve technique 0|. Thus Shor's algorithm does ap- 
pear impractical for decrypting RSA-155. However, it 
provides the only known potentially feasible method to 
factor numbers having 1024 or more bits. 



We conclude that it is possible to demonstrate the im- 
plementation of Shor's algorithm on a Joscphson chargc- 
qubit register. Nevertheless, for successful experimental 
implementation of large-scale algorithms significant im- 
provements in coherence times, fabrication and ultrafast 
control of qubits is mandatory. 

Note added: After the completion of the revised ver- 
sion of this manuscript, it was brought to our attention 
that the implementation of Shor's algorithm has recently 
also been considered for a linear nearest-neighbor (LNN) 
qubit array model |4^ . In an approach similar to ours, 
however, the LLN quantum-circuit model is independent 
of any specific physical realization. 
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APPENDIX A: CONSTRUCTION OF 
QUANTUM CIRCUIT 

Here we represent the construction of a quantum cir- 
cuit needed for an evaluation of the modular exponential 
function a x (mod TV). We assume the values of a and 
TV to be constant integers coprime to each other. This 
approach takes advantage of the well-known fast powers 
trick, as well as the construction of a multiplier suggested 
by Bea ureg ard |3lj . which in part employs the adder of 
Draper |32J. 

The modular exponential function can be expressed in 
terms of modular products: 

2n-l 

aX = E[ ( mod N ^ ( mod iV )' ( A1 ) 

i=0 

where we have used the binary expansion x — 2°Xq + 
2 1 zi + 2 n ~ 1 x n -i, Xi £ {0,1}. Note that the number of 
factors in Eq. IjAlfl grows only linearly for increasing n. 
The longhand multiplication is based on the relation 

2n-l 

a r x= (a T 2 k x k (mod TV)) (mod TV), (A2) 

fc=0 
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|x> 

1 '7n 



b=i>„ 



s 



l*> 

1 '7n 



\a x {modN)\ 



FIG. 8: Quantum circuit required for performing the eval- 
uation of the modular exponential function utilizing the 
CMMUL(6) gates. 



which again involves only a linear number of terms. 

Equation (|A1|) yields a decomposition of the modu- 
lar exponential function into controlled modular multi- 
plication gates (CMMUL(o 2 ')), see Fig.|S] According to 
Eq. (|A2|) . each of the MMUL(a 2 ') gates can be imple- 
mented with the sequence of the modular adders, see 
Fig. Since this decomposition of CMMUL(a 2 ') re- 
quires extra space for the intermediate results, we arc 
forced to introduce a scratch space \z) n+ i into the setup. 
Initially, we set \z) n+ \ = |0)„+i. Moreover, we must re- 
set the extra scratch space after each multiplication. Eu- 
ler's totient theorem guarantees that for every b which is 
coprime to N, a modular inverse 6" 1 6 N exists. Fur- 
thermore, the extended Euclidean algorithm provides an 
efficient way to find the numerical value for b . 

Figure ITU1 presents decomposition of the C 2 MADD(6) 
gate (d £ N using adders in the Fourier space. An ob- 
vious drawback of this implementation is the need for 
a number of QFT-gatcs. However, we need to introduce 
only one ancilla qubit \a). The decomposition of the gate 
C 2 MADD(6) consists of controlled 2 adders, (n + l)-qubit 
QFTs, one-qubit NOTs, and CNOTs. The decomposi- 
tion of a QFT-gate into one- and two-qubit gates is pre- 
sented, for instance, in Ref. Q- Since Fourier space is 
utilized, the C 2 ADD(&) gates can be implemented 
using controlled 2 phase shifts. The quantum gate se- 
quence for an adder working in the Fourier space is de- 
picted in Fig. ^2 The values of the phase shifts for the 
gate C 2 ADD(6) are given by e 2 ^^ 2 "' , where fa = 2^b. 

Finally, we are in the position to perform the uni- 
tary transformation which implements the modular ex- 
ponential function using only one-, two- and three-qubit 
gates. If the three-qubit gates are not available, further 
decomposition into one- and two-qubit gates is needed, 
see Ref. [24|. For instance, each three-qubit controlled 2 !! 
gate decomposes into five two-qubit gates and each Fred- 
kin gate takes seven two-qubit gates to implement. 



APPENDIX B: DERIVATION OF THE 
HAMILTONIAN 

1. The Lagrangian 

Consider a homogenous array of mesoscopic supercon- 
ducting islands as an idealized model of a quantum reg- 
ister, see Fig. |21 The basis states of the qubit correspond 
to either zero or one extra Cooper pair residing on the 
superconducting island, denoted by |0) and |1), respec- 
tively. Each of the islands, or Cooper-pair boxes, is ca- 
pacitively coupled to a gate voltage, Vg. In addition, 
they are coupled to a superconducting lead through a 
mesoscopic SQUID with identical junctions, each having 
the same Josephson energy Ej/2 and capacitance Cj/2. 
All these qubits are then coupled in parallel with an in- 
ductor, L. The lowest relevant energy scale is set by the 
thermal energy k-gT and the highest scale by the BCS 
gap Abcs ■ 

We assume that the gate voltage \Q and the time- 
dependent flux $i through each SQUID can be controlled 
externally. The flux <&i may be controlled with an ad- 
justable current Ii through an external coil, see the dot- 
ted line in Fig. In this setup, the Cooper pairs can 
tunnel coherently to a superconducting electrode. We 
denote the time-integral of voltage, or difference in flux 
units, over the left junction of the i th SQUID by fa and 
the flux through the inductor by (p. The phase difference 
in flux units over the rightmost junction is fa — We 
take the positive direction for flux to be directed outward 
normal to the page. 

We adopt fa and tp as the dynamical variables, whereas 
<&i and Vg are external adjustable parameters. With the 
help of elementary circuit analysis ^4|, we obtain the 
Lagrangian for the qubit register 



1 ™ 

£ 4E 



i=l 



a 



2 1 n 

2L 2^ 



2e \ (2e 
E 3 cos ( —fa J + E 3 cos [—(fa- $i) 

(Bl) 



We now perform the following changes of variables 



2 



(B2) 



which yields 



1 n 



2a vi 



+E ' C0S {"To) C0S U^ 
i ™ 

+ -A^ qb ^ 2 -£c qb (U g * 

i=l 

+ const. 



2nC q h 




2 >(P 2L 



(B3) 
(B4) 
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Swapping 
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FIG. 9: Decomposition of the CMMUL(a 2 ) gate using C 2 MADD(&) and controlled swap gates. If the controlling qubit \xi) is 



active the resulting state is y' = 
\z) n to perform the calculation. 



y + a 2 (mod iV), otherwise y = y. Note, that the gate utilizes an additional ancilla register 
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FIG. 10: Decomposition of the C 2 MADD(&) gate into el- 
ementary gates, QFT gates, and additions in the Fourier 
basis (C 2 ADD). The asterisk stands for a Hermitian con- 
jugate; it corresponds to a gate for subtraction. The gate 
takes an input value z < N < 2 n and yields \z')„+i — \z + b 
(mod N)) n +i if the control qubits Xi = 1 and yj = 1. Other- 
wise \z') n +i = |z) n +i. The ancilla qubit \a) is one if z + b > N 
and zero otherwise. 



parameter in Eq. i|B4() as 



(B5) 



The canonical momenta are given by Q — dC/dtp and 
qi = dC/d(f>i. We interpret Q as the charge on the 
collective capacitor formed by the whole qubit register, 
whereas qi is the charge on the i th island. Note that the 
charge qi is related to the number rii of Cooper pairs on 
the island through % = — 2erij. 



The Hamiltonian 



l^) > — [fo 



k> 
\yj> 



0i 



FIG. 11: Quantum circuit for the controlled 2 addition of a 
classical number b into the quantum register in the 

Fourier basis. The controlled 2 phase-shift gates serve to yield 
the phase shift e 2wt ^ k ^ 2 provided that the control qubits \xi) 
and \yj) are active. 



We are now in the position to write down the Hamil- 
tonian for the quantum register. We will also immedi- 
ately replace the canonical variables by operators in or- 
der to quantize the register. Moreover, we will employ 
the number of excess Cooper pairs n.; on the island and 
the superconducting phase difference instead of the usual 
quantum-mechanical conjugates. We will also change 
to the more common phase difference 9i related to <pi 
through Qi = ^<^i- Hence the relevant commutation re- 
lations are [#i,rii] = —i and [<p, Q] = ih. All the other 
commutators vanish. Using the Legendre transformation 



H = Qip + ^2 q l (j> i - C 



(B6) 



we obtain 



Above, $o = h/2e is the flux quantum and C q b = 
CjC g /(Cj + C g ) is the qubit capacitance in the LC- 
circuit. Note that the effective Joscphson energy of each 
SQUID can now be tuned. We denote this tunable energy 



2e 2 (n t - n\f ( 2nC qh 

- cos 6, 



C, + Q 



(Q + Qg) 2 

2NC qh 2L 



(B7) 
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We have denoted the effective gate charge by 




and 




(B8) 



(B9) 



In addition to the usual voltage contribution, the time 
dependence of the flux also plays a role. In practice, the 
rates of change of the flux are negligible in comparison 
to the voltages and this term may safely be dropped. 

The Hamiltonian in Eq. 1|B7|) describes the register 
of qubits (rij, 4>i) coupled to a quantum- mechanical LC- 
resonator, i.e., a harmonic oscillator (Q, ip). We will now 
assume that the rms fluctuations of ip are small compared 
to the flux quantum <!>o and also that the harmonic oscil- 
lator has a sufficiently high frequency, such that it stays 
in the ground state. The first assumption implies that 



cos 



27rC qb 



r 



2ttC, 



qb 



(yssmt 



(BIO) 



The second assumption will cause an effective coupling 
between the qubits. Namely, the Hamiltonian may now 
be rewritten in the more suggestive form 



TL 



E 

i=l 



2e 2 {m 



(Q + Q e ) 2 , {<p-<PY 



2NC qh 2L 
where the operator tp is given by 



2V 



(Bll) 



™g±Y^E^M . (B12) 



We now see from Eq. (|B11|) that in the high-frequency 
limit the harmonic oscillator is effectively decoupled from 
the qubit register. The effect of the qubit register is thus 
to redefine the minimum of the potential energy for the 



oscillator. This does not affect the spectrum of the oscil- 
lator, since it will adiabatically follow its ground state in 
the low-temperature limit. We may therefore trace over 
the degrees of freedom of the harmonic oscillator and the 
harmonic-oscillator energy will merely yield a zero-point 
energy contribution, Hlulc/2 . The effective Hamilto- 
nian describing the dynamics of the coupled qubit regis- 
ter alone is thus 



H 



E 

i=l 



2e 2 (ni-nif 



2n 2 LC 2 h 

$ 2 c 2 



(B13) 



This result is in agreement with the one presented in 
Ref. [2(j . We conclude that the LC-oscillator has created 
a virtual coupling between the qubits. 

For the purposes of quantum computing, it is con- 
venient to truncate the Hilbcrt space such that each 
Cooper-pair box will have only two basis states. In the 
limit of a high charging energy Eq = 2e 2 /(C g + Cj) rel- 
ative to the Josephson energy Ej, we may argue that in 
the region < n l g < 1 only the states with n, = 0, 1 can 
be occupied. We use the vector representation for these 
states, in which |0)j = (1 0): and = (0 l). . 

The basis states of the Hilbert space are orthogonal 
{n\e ±ie \m) = 5 n , m ^i- Hence, in this two-state approx- 
imation, cos#i = and shift; = \o l y , where, e.g., 

Finally, omitting 

the constant terms, we obtain the Hamiltonian in the 
Pauli-matrix representation 




i=l 
_2 



TTK 1 ~ Zn fO a z 7, <7 a 



Ec 
2 



E E MWWy** 



i=l j=i+l 



(B14) 



which results in Eqs. J5J and of the main text. 
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